T01 · Skill Instruction Hijacking
Error
- Location
- scripts/watch-news.js:129
- Finding
- Untrusted Remote Article Content Is Passed Directly to the Main AI Agent<![CDATA[ ## Vulnerability Details **File Location**: `scripts/watch-news.js:129-145` **Duplicate Location**: `watch-news.txt:129-145` **Vulnerability Type**: Prompt injection through untrusted remote content **Risk Level**: High ### Vulnerable Code ```javascript const prompt = `以下是一篇来自 CoinDesk 的加密货币新闻全文，请用中文进行总结分析，不要访问任何网址： 标题：${articleTitle} 正文： ${articleContent.slice(0, 4000)} 请用中文回复，要求： 1. 核心事件是什么（2-3句话） 2. 对加密货币市场有何影响 3. 重要性评级（高/中/低）及理由 格式简洁，适合 Telegram 阅读，控制在400字以内`; // 调用 openclaw agent console.log('⏳ 等待总结结果...'); const result = runOpenclaw(['agent', '--agent', 'main', '--message', prompt, '--thinking', 'off', '--timeout', '90']); ``` ### Technical Analysis The article title and body originate from externally controlled news pages. These values are interpolated directly into an instruction prompt and submitted to the general-purpose OpenClaw `main` agent. The prompt tells the agent not to visit URLs, but this natural-language instruction does not establish a reliable trust boundary. An attacker who controls a published article, compromises a supported news site, or injects content into a rendered page could include adversarial instructions in the article text. Those instructions could attempt to override the summarization request, manipulate the generated response, solicit sensitive information, or induce use of tools available to the main agent. The code does not use a dedicated tool-free summarization agent, structured input separation, schema-constrained output, prompt-injection filtering, or independent validation before forwarding the result to Telegram. ### Attack Path 1. An attacker publishes an article or injects content into a page that the watcher treats as the latest article. 2. The attacker embeds instructions in the title or first 4,000 characters of the article body, such as instructions to ignore the summarization task or perform unrelated actions. 3. Playwright extracts the malicious text from the page. 4. The watcher inser ...[truncated 1131 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Create a dedicated summarization agent with no filesystem, shell, messaging, browser, memory-writing, or other external-action tools. 2. Do not invoke the general-purpose `main` agent for processing untrusted web content. 3. Pass article data through a structured interface with separate `title` and `body` fields rather than concatenating it into the same instruction channel. 4. Clearly delimit the article as untrusted data and instruct the summarizer to treat all instructions found inside it as quoted content. This is defense in depth and should not replace tool isolation. 5. Apply input validation and detect instruction-like phrases, encoded payloads, suspicious links, or requests for tool use. 6. Require schema-constrained output containing only expected summary fields, such as `core_event`, `market_impact`, and `importance`. 7. Validate and length-limit the generated output before including it in a Telegram message. 8. Consider using a deterministic, non-agent summarization service or a model endpoint that cannot execute tools. 9. Keep the duplicated `watch-news.txt` synchronized with the corrected executable source or remove it to prevent vulnerable code from being reused. ]]>